d0a90f7cfefa61952211b59b9268683bc32c6352cb11a92c7a2eea9766e72abf

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
Size 1.6MB
Sample260727-xbbwtsck2s
SHA256 d0a90f7cfefa61952211b59b9268683bc32c6352cb11a92c7a2eea9766e72abf
MD5 f65942c29704f66a843c00f6ade94dc5
SHA1 816e5cac4f2a522699e8cc47c8718ba1ab7526cf
SHA512 a786a83033ba635e7e32f19e40d95d6aebd69d930d85b9a45975a0f397bcd8a600ca4f724987d2e7cb8be865e46ade34abcfd5f9626ec07aef43f928666028cf
SSDEEP 24576:ZtoTRKf5TpmwLt3iRu/ocxwKDJKIe05Qws:MRKrmwx3lwcx/Kt0F
TLSH
T11385011776A460F8E27B863589528515F7B2BC311B218BCF136063BE2F376D1AD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3640	elevation_service.exe
5840	elevation_service.exe
3216	maintenanceservice.exe
5832	OSE.EXE
5472	PerceptionSimulationService.exe
1920	perfhost.exe
5100	ReFsDedupSvc.exe
3052	SensorDataService.exe
3420	ssh-agent.exe
2660	AgentService.exe
2184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e22553e0e05f6396.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010fbcb73f71ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096721875f71ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b3057b4f71ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cbc7a74f71ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f249fc74f71ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
3640	elevation_service.exe
3640	elevation_service.exe
3640	elevation_service.exe
3640	elevation_service.exe
3640	elevation_service.exe
3640	elevation_service.exe
3640	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
Token: SeAssignPrimaryTokenPrivilege	2660	AgentService.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: 33	2184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2184	SearchIndexer.exe
Token: SeDebugPrivilege	3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3148	2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3640	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3972	2184	SearchIndexer.exe	99
PID 2184 wrote to memory of 2540	2184	SearchIndexer.exe	100
PID 2184 wrote to memory of 3320	2184	SearchIndexer.exe	101
PID 2184 wrote to memory of 4100	2184	SearchIndexer.exe	102
PID 2184 wrote to memory of 4872	2184	SearchIndexer.exe	104
PID 2184 wrote to memory of 2264	2184	SearchIndexer.exe	105
PID 2184 wrote to memory of 348	2184	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_f65942c29704f66a843c00f6ade94dc5_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5472

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3052

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 94ec5c3869dd5931037c5df2163d4f94cec5984f7df495fb07f3ff2009f9ebbc
MD5 7b27f46706909113e818ff02a34739f3
SHA1 491a285be620ae6197e87faefed256d4891da5f9
SHA512 4cd437e6f9b1387af15097c3f660d47d93d2d740092474ac99aca98e6dc6541f0fff766b156052a465ba418d2969c623e6721b492ec233389373b7e8e3949ce0
SSDEEP 49152:Ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxntrmwx3lwcx/Kt0F:Q3q60jBiPx3lweSmF
TLSH
T1C3D58D03F2D900E9E06ED178D7469132EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c75cb7fd89ceeb404a4195273b7d334ee0f5b4586c1e034da131bc234b2b875d
MD5 aabd47c257bbf9dd39731ea27f33c82f
SHA1 57a745c74d59e538dfcad186f18ab13b0d5803e8
SHA512 6fd0887c6a6d322f06ec0bf38b1486ee18d9ea807fdc048a8550dac447bbbfdd82fd781c0c288ca6f324390867853c0e0764f97fa99dd46a8b7d94a090dd9677
SSDEEP 24576:fXYfDtczAaf5TpmwLt3iRu/ocxwKDJKIe05Qws:qtcPrmwx3lwcx/Kt0F
TLSH
T1CF85F12877D408F9ED6B8279C8A2C511EA737C514360E7DF03A4A9691F332D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 49c72a1727da3a7d26ab252511582932e21cf63110b1f14e17f5e5fb972acd0e
MD5 e71a03730470f6cadef69e5f6cb4e5c4
SHA1 83b381e033c9967bf511a07bba012e87bed19415
SHA512 f1e2d53941db63a1034d09d293f7a95175f4f2a419fb80049094ff3436416132382ff13166d8182a45cfd3a09cec8dd9c8573df5432be97938cc49f2cfe1d806
SSDEEP 24576:H0Le5ji0hmxorMFf5TpmwLt3iRu/ocxwKDJKIe05Qws:HPji0AO4rmwx3lwcx/Kt0F
TLSH
T126A59E26F6748335D073C0B9C5D2A68EE971348257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 41e7518b78e3c1cef3e5fed9f5b23ab7bbf1f46a366656eaba5bae9d9755f11d
MD5 63ff57d674112ca30398e8cfbf0e7f12
SHA1 168c0d82f2d7bfb4d780b2111007200c550ba726
SHA512 cb980dcf4096ccb7c2b2bae9d3980a12a8fc41425c134c15be69abc4793d54c54f086772a7f6a177d3dcf1cba0276673642a48a82df6d51a680e6015f76efefd
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWr6q8wyuff5TpmwLt3iRu/ocxwKDJKIe05Qws:U/ezSC6vUzPviHjy0rmwx3lwcx/Kt0F
TLSH
T14D755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 60b39efd44937cbf9145d8cf2c9a9166eedfaf1e70d8203d6bb6b4fc360b269c
MD5 93b1c5237dab495fd77f5334d97523f9
SHA1 bb609f99e25f939b51c19a6aef1b235b6dd902f7
SHA512 aeebbe80a9074b2e7ebba0f241f65dfccf78205e96d7cf2c86f748ba913c51dce61404ff235c5d54ce3a50513965f78507222c2b15400caec100b742a3694aee
SSDEEP 24576:xVbqPb88hv/l+bef5TpmwLt3iRu/ocxwKDJKIe05Qws:xVO88hXl+irmwx3lwcx/Kt0F
TLSH
T181559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 6f49213a3c78d5bc2309a7ab48761314699d2401ffc7d22995f78da78ff66c30
MD5 f3db598dba9c35601f32c5a9c651c201
SHA1 62a7463bb54741a6f3df28b1cb9df81cb24aeae0
SHA512 99607720acacd13a44f5869784415233ae3d93ec2aba512edee894b1913677469cf9f20d62dc5b80e8f5b7c17180a93a77539520165bf77549b39a5efb42ba26
SSDEEP 12288:DBJYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:DBJf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T16B7523295E894560E75E4A73668BCA5435B17C3070268AAF7232FCCCAD395F5F93803B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 0f71d3525b502c112ca69e10c3345fcee993601c7631a12616fd593539b20766
MD5 aba92104d9992e0be9eca69e7f383aed
SHA1 1e93a569a09976ff2de49c9312d4581c52b8bdfe
SHA512 7380ec37100dc476328df93e822f29c666dc44699b60f92b61e46f7fa239edea807c135b82f844327d868871564c0b44262d60c10c26fc045b57aed968636b9b
SSDEEP 24576:QJIUWf5TpmwLt3iRu/ocxwKDJKIe05Qws:QJIUWrmwx3lwcx/Kt0F
TLSH
T10185CF3BAE28FCD2C27E8DB95691C600A77278304B2293CBD175D24EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 25cfce0ae2473b95e8717b72c7c1bdefb1f0c165c6dc8aa22b4cee47e3b01035
MD5 acc8e2eb75a653105447748b24540139
SHA1 18aa55dd8f4f61a7eadc5041b9d4fbf3908096c2
SHA512 cc4f8322195439a7b0e526ee8d1bb1e4c559e9163b2869c510082d32ff97f4dbc40a61c57338278c2c0367e9fc82be72ef7804ef4a9d4668105821785684b631
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THe:uQvGAdlCEL8c/RRNw5CjPx3lweSmF
TLSH
T102267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 1acd04bac57f9153bbaeeebcc94e183cdf1e03422380df2291a4047e4df7e6c5
MD5 2ddef42d3d3b05efd4100e659b62e45f
SHA1 f91fe81251281c85388c52420a049a2a75491359
SHA512 105607de0bf60c4ed5addb8a64ee3bee604781178e895c77d7710deff9f1a5457470655c59d329aa4f50b91cbb7fbdd7ec8ab258517dc9e65dea4bf5bb8684f8
SSDEEP 24576:ZdewsAjIf5TpmwLt3iRu/ocxwKDJKIe05Qws:7ljIrmwx3lwcx/Kt0F
TLSH
T14E95E031FE74E436C37F0DB21B26C71624797D204B621AC3E3A8AD8D59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c5e94c463b027b2cdb3b11db31300345092855b8915f869b748c15276565b63a
MD5 a6b386ba5c903186e7095f19b21e8716
SHA1 5effbfed08e62c6a853ffd38cc2b9b0cedfbb127
SHA512 f28566e77f9abbf253afeb3123cb218fcbc15f592c454f458a25826f5e7119b79fb5efe4181c50ef8069cb987ef66f4b739d5b4610a89e74485b5f962596ce56
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHsPvl:0UEtQevvqc2W1cpV2RI32S
TLSH
T120474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 53c051abfbf199d5bced3ddfa7f0b896d044f0faf151779613a3639d3efd91ac
MD5 b99748d5745badbcf7b7846f70359275
SHA1 a23b6833fee05c296cbecbf25ca7127dc5c96e77
SHA512 0e8ae1552f6a4351d2ccb2a86803537886d50d6de63942cc6d0f1adb43e39913451a6c0fe7650936aaafe20ec92db976aa1781bdf9f81ae0298cd6cfd2807df5
SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/zormwx3lwcx/Kt0F:hoquVjnmPPx3lweSmF
TLSH
T1CED58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3ce193468beff8d4ee4cca118611f5c3a469b8624021e9a66ad674247cd09a6a
MD5 78cf22909023717f3dc384c8d93f6381
SHA1 dbc557ceee1a671bafa68a8ea15837ad4189d73c
SHA512 da29deb1a3c695c7b7680e996703cf12197482bbded3f06446d424750ed2c2e8ba417504a0d58390ff76219356b03474f1ef77c89ec636ddac14aaef06e6576c
SSDEEP 24576:DAhGL2IFoiwtA5l7S53Lf5TpmwLt3iRu/ocxwKDJKIe05Qws:DAM1Foiq57rmwx3lwcx/Kt0F
TLSH
T16135AE80EBF955D4F5B7AA7899B68170EA72BCA65E31C20F2160D14F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8c0dfb1b3d1b99b0edb391d3dcb4b85dba7c93652085b106e0431d9e035432fb
MD5 91ccdc5093d5a6f6e424ca1177b33ff5
SHA1 3fc70fc76a811b073aeeb7892357b239ee5c7d2c
SHA512 fa3413fa45582684e933cbb5b2ff50532956da16a8960d18ec35e75faef21cd846dafbb8469b4677b03436f83a82792e7c5904f74f73673bfd31caabfd3f91eb
SSDEEP 24576:UwuoOWUf5TpmwLt3iRu/ocxwKDJKIe05Qws:UwLO3rmwx3lwcx/Kt0F
TLSH
T10985F14936E80CF9EA6B82398547C535F7F2BC112621DB1F1360D69B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 46984ce4f123569a2693b1cbe9009e7d53e9048de6e67fef4c7fd4d74d8fa10f
MD5 a9d013641a0224d9219fbfcfa706aa72
SHA1 1da4435acf0401f968ae4883ec3d8e783e7f509b
SHA512 7ce6ea51e2ae81cd14d4581496df72350db3400bc4315d60137104f78d0c1832cd34613176313ede61e4b8d4cf511dd106377cbb4e6af3bb74e5eb02a8530b2f
SSDEEP 24576:GZu9f5TpmwLt3iRu/ocxwKDJKIe05Qws:Jrmwx3lwcx/Kt0F
TLSH
T1F875125926D820F4D36B427AD9E68604E7B27C62233643CF2225B5D96F33AD16D38733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f8644408eb59830b09352b88504c286fa8cfccddda72d500bd9fdb9a2bb1779e
MD5 ffdfaadb063bf52680f5b64d15927541
SHA1 29a634b786058cd19a99a0c6381197efe87beec4
SHA512 4510bf51fec238c655d8d837054f95d096fc48e970e41f78adeb22b8cffb3e53f824fd042d4854b1e8a73b0db714bf66808a8b27e9b59fed3b163967be755903
SSDEEP 98304:nQRQyi36YOcPhLvw2gAf+PN3WPx3lweSmF:2QyiKahX+PNGPvl
TLSH
T117667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 743d02ef9c19a0af8b9e5b623f7d4590a1635147f26cb65729356d8c414df382
MD5 bf08470b1c2eb40e3ca72a593af60f28
SHA1 243daa2bab333e9af9e6a69795400ef3ec69b498
SHA512 d470fc9a09c51b648ddbaf1bbb58748b9148ceec27a95eaa552fd589ff014b1134dd8cdea4d62313c28be90c9a758ec4935c61cfcc767b6f82c7a6a2171aae2d
SSDEEP 98304:BQRQyi36YOcPhLvw2gAf+PN3WPx3lweSmF:YQyiKahX+PNGPvl
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 89b8223f0a1664ff8ddadf0d1ba89ede7fb4a41149e137c061578563ca31d6da
MD5 04e48d198963d3314760ecf6fdcbb77c
SHA1 ce4479e2408eb3766820dc3094faf793d349077d
SHA512 0e07a79865eba635b17796ee76516415397fc2f96935fc3e21e015f133c0e94264eeaabe98c5daba0ea6efc3750ca218c463b99e05e0b5a37eecc55562140312
SSDEEP 49152:D68Qg55nhceWu7PNU3/4rmwx3lwcx/Kt0F:9thLRc/EPx3lweSmF
TLSH
T13DB55933B2F600A9C44DE1769F4A872196D17C718FE1E3DB8511724A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e380d755557ca0a45e379249dcb3326b01c6460f993f25f7add0f2dfe92ad8c2
MD5 e0aaea8ac07ecf6dd9ad83e47f4af7ab
SHA1 4eb38d2ece0e5bc698191e479d5519962e5dc24a
SHA512 c37c43bea32f1c5ae802439516490a7730fd25e51fd6c9d56b5fbf5707402994edd32bda685c27965cf5f14e34ab6e7f5c4cf1437d53d44029b519c917b27612
SSDEEP 98304:sy5112gYy5azzVva69nLKnhZVPx3lweSmF:tLIHjWhnPvl
TLSH
T1D3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf22abc2122285c7097220d73b1e849541d3677a0533eaad6a8b111b626bb85e
MD5 fa256241a66ec54a9d5c5e245e5b0b24
SHA1 34fb2b307e8ff7adb935e72e0a31f164a82f1858
SHA512 87575494c86aa3f284c3b4a5f4b7b38d14c552f32f3bce522a4b3e5c179f1cc28520d8a6bf29e6298eb65f9e737de6414c4272714d9065aa24bf5e2ff0db5f6f
SSDEEP 49152:gB+taZ3usBWOBr4tEG20bqx0z+n217aau1glKrmwx3lwcx/Kt0F:6u6JmUxd2d+Px3lweSmF
TLSH
T171D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 351b33ecbb86a7da79dc73e4208800183514a12a856c3f50d68bc9fda5b8730f
MD5 e0b480d83de5c88f7f75eb289e18d66e
SHA1 91c2a0835918156117eabf1615d54136131851c8
SHA512 77a054ba1a064d74b12402f72cccc3f5697ca417bd732bbde7d9548cecb565492e44ffe138080923db3facc69e3f070f5203fcedb1e772bb2bd4a7c32e16c31f
SSDEEP 49152:M1hpsNoJpF1A6BU44CwH7R4x2rmwx3lwcx/Kt0F:MmifPkRPPx3lweSmF
TLSH
T1AFB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5e845191197cef8c6ae796418301d0e7876770f5d7a616fde9e48f547faad18b
MD5 40489856df5920351abfba50089727cc
SHA1 85568f5b870bfb4c228498c5e33402f4af579011
SHA512 3ab1a79fc7ec8067d34e5db8dc054863e1115d57590b062e8a2e6b06b3e92565a35aea398d4efcc5896a2306ccc263724414d240c0130b533d90a3beba9f6218
SSDEEP 49152:2SuZQIY0Be2KNRVtOnks6NMHq9rmwx3lwcx/Kt0F:Y5dKvi61pPx3lweSmF
TLSH
T1C7C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 17226f368beb0bbc35e87f559ed9f0982544f08712c4990afbfd2b7d9fa12f71
MD5 880ec181b6d0c7b17af5dcc08df44238
SHA1 a8832130765c881b1f1595e6901a0f96550c65a1
SHA512 b79b9231f99d59fd8fcbccd9a09b2037aa1d942e7b8b1e91208f48fd3f41a223fe60c625595b525ba180493d0bbc00807cbfd8c6c8ab1e0e435d5f7e664ed4fc
SSDEEP 49152:hhtSn8EApI0figXgiDn0AP5warmwx3lwcx/Kt0F:wX2iyphbPx3lweSmF
TLSH
T10995BE13F2D900E8D05ED179C7468632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 ba8054e2821b2a60149b853ba9972d6585654c7ec33626b60e2ae94184da932e
MD5 9fad01434e1cb13a01fbfa24b79bcc2d
SHA1 55f246c5a36ab7abb51ebe594dec582f2f973dc3
SHA512 5835d7b8b523107a30244d83a1c04ea8167a85d15698f17bb5eef755bda92e9ea41d20a876e554bcf9b39ca81628e0be8fad3ece66eeed193c56f5dec04cea69
SSDEEP 12288:ghYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:ghf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1486523285CCA8664D30D46B3964BC64875B17C32702646EF322AB8CCBE3A5F5B53843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 278722aa991a88cf5526bb175825c81806970c3320e8926538cde299be5eb0d0
MD5 96247883c513079572282da60ec617d7
SHA1 e26de111d1d2b6e592ed7c74f20cb3ae075e326a
SHA512 ad4a4147efd9bfa2f7c9d81257b113231a445ca855fb53209f6a5fa221c31263c0c0e5a9abf0a71061861c9c482634fbe5fcbb763d2e6e4b82779b54e290b97e
SSDEEP 12288:dcYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:dcf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1006523286D8E4564D30D46B3964BC64865B07C32702746EF732AF8CCBA7A5F5B53843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 157e6afdace54b46226edf6fc19c9e05a9c20dd67af76cc026d335baa2432a52
MD5 8be0e989bc496eacec649d57968685f4
SHA1 dca1a6bfb0652c88ee6be587cddcefad1a3205b4
SHA512 cd12b3dff5392d21c5cbaed432b30332dfb0eff5607e2f76de89c4a50efd15c99e890da2176e001a2d3c269be0ba90921f4e4ea961704ef3e75d8bacefcf5599
SSDEEP 12288:6OYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:6Of5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1566523285D8E4564D30D4AB3964BC65865B07C32702746EF722AF8CCBA3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 a7f707fbd79463390f420fc8a2c719e11aa683923887671698972b6116f58db3
MD5 da0f30e51afe13d87576e8e06f834021
SHA1 096e29874c47d247f98cd253f58619f50f0b2bf9
SHA512 243fbb9b531a224f999b5c3b84b265d57208044897e85624b89c19d04275a16fa42e340568533339bcc9aa44afcd49aecd0058810c38599e5871dcd5101efc99
SSDEEP 12288:UVrYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Sf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1947523292A9A41E0D71E8677C656C214B6F17C71B13287EF731178CC6E327E4B93893A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 bb199e9ae611341305ca4a983e971e09ee841c635c0c2d8b74ea7b4374b90ef3
MD5 80316dc3022dc3dd426e28507026d908
SHA1 2ae50b0eb0ea484d0e49414d20666242e5d10839
SHA512 1b1d226c42b0ca1cedea5a9db9473ded07339848b6d476151aef7dd08b19c63956c7ce86e339f9953be44234171842057f80d196680be60a3e2b3f762302e63b
SSDEEP 12288:8TYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:8Tf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1006523286C8E4564D30D46B3964BC65865B17C32702646EF722AF8CCBE3A5F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 9520b786867de6bb1da56b5fd3936012f03b47018a00e1b85dd5a47914b88f26
MD5 de8a3288abdde7d43721f1f96144bf68
SHA1 5344734edbd4aa27005ead8817533dee0db72cbd
SHA512 b868ab97f00b5bb5dfaea13958c3130637eb03105fac44b5390436cb30f61389b08de53f31f4453ad21cc1da4ab7fb8619482b04aeb4bd727897cf6b69b80130
SSDEEP 12288:XgYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Xgf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1366523286D8E4664D30D46B3964BC64865B07C32702746EF722AF8CCBA365F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 b91fb0dcf5583c6948f4008072416d23ac5b9030b3f26d114cc1f6751527ec4b
MD5 3b1cd928db54ab61f3ef5736dc564ae3
SHA1 3322fc2646b43ba520ed2209dad4af49c5de3545
SHA512 9d2f395b3bb1870ab65f926f51841ff1813f85738d10b2719fb8e676ccbef2ebed130bb53935901e44680ca58f3e1e6540c8b4eba801201b007dc8822c6dde9b
SSDEEP 12288:LEYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:LEf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1E46523285C8A4664D30D46B3964AC65865B07C32B02746EF732AF8CCBA7A5F5B53843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 07630bdd74f48b470fc9cede4fc45c33d5751dd9c06c7ad561d2d0f093eded60
MD5 aaa33f3030801744b21bd43fd7d15b7c
SHA1 df54d34a98d6d8e40bd0f030d4fc1161c2868503
SHA512 4ca09234e7fe797600d73cde70210d6e309d383877ad9228eb51f95fa1086d61b6e7d8bfecc2ab08bd0e374452317dd058bf38573d10cef60d612e85e61b2033
SSDEEP 24576:jZMdzFVSO8f5TpmwLt3iRu/ocxwKDJKIe05Qws:jZMdzfwrmwx3lwcx/Kt0F
TLSH
T1D685026573900CF8ED6B823EC9568905D6F27C2A1670C65F13B436AA5F333A11C3DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 957a0ff74fa358cf130c29ed10bb352dfeb08b84ee3146dc2820ea7f35126df5
MD5 5ebcddbbb4d2eff61267a70032d48afb
SHA1 0eebfae17274af7152de6d6be8ea51df7329420f
SHA512 6dac69525932af05109952c14769fcc31c46e45a4105e961c4cf8a0860146de2ed619af4569fd0f61ab35a0168ddbeee3aff504b058285be1867f8906582df6d
SSDEEP 12288:GNYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qwsx:GNf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T13D6523296C8A4564D30D46B3964BC64865B07C72702746EF722AF8CCBE3A5F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 a6d0cc77a1ca84a3aa3a29afbe0d257dee49a071bf6f789ac9447664080fd36d
MD5 f2d054037a84a6448e9d04776ced9efe
SHA1 c92f1b684cc9b8b38bea7cfb024e6d58cfb0c45e
SHA512 66b5a50488b442da682cdd1c74efb521e45ea6532c1b9c270028b12abb152c122158de99360a68bbf3526e917667eac512e111db32f32a74c64206fe5ea6ec44
SSDEEP 12288:QZYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:QZf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1996523296C8A4664D30D4673964BC65865B07C32701746EF722AF8CCBA3A5F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 3e6cf301f4af25c565d0e113027aa5537a811a954ec810ae338b934fe3836aae
MD5 f0bb8961e144017ba83b5f8ee82665cf
SHA1 86c1beabdf546e93ba3a0ff69056ca54617faeeb
SHA512 f860819a271ff090c77dd1f246e7b47bf56eaf7f2033a53fabb6e1dfa6705d73ba9a4c1df7ff7abca14077343254e8870528408d89026f19cb831d732e340592
SSDEEP 24576:nzyYf5TpmwLt3iRu/ocxwKDJKIe05Qws:nXrmwx3lwcx/Kt0F
TLSH
T13075121777A520F8D22A8235C9524A05F7B17C3257218BEF236466BA2F376E09D3DB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 865bfb39f40eb8c28bae779f7557f4081e4341297cdf758f4f02c1707af40cad
MD5 f1b23d90dc61cca9a4182ccaa078f196
SHA1 b564b19dc46e7ef045c1d56fa67395dd4164cb7e
SHA512 c8812b9b631d3a7f7d5bb841b82a1510ef3f1e2d781c770e97f45a4d3a2aa714efcb1bd150c7dcb7593ec880b19e9382e27a8bf605ce467237abf54d26689296
SSDEEP 12288:PNYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:PNf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T16C65232D6C8A4564D30D46B3964BC65865B07C32702746EF722AF8CCBA3A5F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 0ffdab50d3eadff218f5f0b1303dd63e198abf56bc1a0009608cb3bc0176cda8
MD5 08c0379496c89eb4185e09928a5db36a
SHA1 b36a6d7b1e1967d49b0fd19ecd907b866f8a4c04
SHA512 50cb5d292f579854580db9e68a4d6473cf4d3ac2b54983b054fbaa3155262a2bed39f9bef66418c71931bcff1cc4976bbbef3b615d949a3767e302ffc7b891a7
SSDEEP 12288:bNYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:bNf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1A46523296C8A45A4D30D46B3964BC65865B07C32702746EF722AF8CCBE3A5F5B53C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 d18020ec6f6cdec3a4f765fecdfec6200ad035c1ec6557b94ef336303c7e1bb0
MD5 34519c339df21e0774b33080a6759476
SHA1 58ab684769b82594a204fce080fe2e5a6d41eace
SHA512 4844b3a675b37b659d85e6915c92b5683ef2273fed3a851118099d802913c60c85da6df6ed748c1d47ce51a1e7072fc52f56b9ca02c180f1ce1935a1d4ae8397
SSDEEP 24576:8zyYf5TpmwLt3iRu/ocxwKDJKIe05Qws:8Xrmwx3lwcx/Kt0F
TLSH
T19775121777A520F8D22A8235C9524A05F7B17C3257218BEF236466BA2F376E09D3DB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 1e0e2b116d1e95c923fce1e7c51d76a1e3b10b373d10196f2d02e7a31c0df33f
MD5 a16f6885f7fffa1ea57de61fe4507be3
SHA1 37c90d6b996977811e50dee2cdf01589aa5f5b5b
SHA512 3358c0689290a3a4909c377d11c673ed610a8e800787cc9e2e41b4e8408fd7790fc8c19f5323f03c0145d7027e000be9da8443bbdb8947b62c23a4468c72a9a2
SSDEEP 24576:QTSaLl3z0zD+f5TpmwLt3iRu/ocxwKDJKIe05Qws:QTJLljfrmwx3lwcx/Kt0F
TLSH
T1B5850264B39018F8ED6B813EC9568905D6F27C2A0770C65F13B436AA5F333A15C3DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 500f27f70d43044b5a15a49da47580e7cb1befbd789d36940c333b64915782c8
MD5 5b161d62c8941c601934f0cb81fe32d2
SHA1 f996a73a3759264eee31f61ba9694a031b684c22
SHA512 ab48ff51340a955690cbe055ff2aaf672d5b2b874b40b1bf24636f9e1ea50d9397db2a4a21821aaeeb5ecb774259f40b3584e2f87e59fbbc67eb1b5e0548536b
SSDEEP 24576:B3rd9CHKy7GZSf5TpmwLt3iRu/ocxwKDJKIe05Qws:xrd9CHKyawrmwx3lwcx/Kt0F
TLSH
T12F95CF90F3E414E8F1B79A3589768511DAB67C6A1B31CE8F03A4655A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 37f841734ffe4a4c2ae392b5e78413e1c3e7b63bcdef43769c6663a8f0bced17
MD5 f42a038e9c16c0fe8a39f753b98af651
SHA1 0c03ade7d4652c129ec1062a2342d61c71fbdf2b
SHA512 7479d568936367d4889c525e69df4a14cd2a6ada4f64c88de341a8e83c67c4ca9835b85ec297dae674de23f5dc86c25f31d108733c312d306a521769228dc6ef
SSDEEP 12288:8uYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:8uf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1526523286C8E4564D30D46B3964BC65865B07C32702746EF722AF8CCBE7A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 90d3cabd04221c9a870bb84c988b8d8d3d46caebf841d0defc207882948e2a0d
MD5 94bb7a1e60706236b87598cd8bd3da40
SHA1 74159ed2d6b53c24aa4d7f1490c993b670fc9442
SHA512 46a251149b2ce7b2bdcb73202fa30729704370fadf660b8ce15f9905d592cdaa5ff31e77f05134b4c7e82ea7f4ecc8738658dd5caefbedead80287ffb50cb6bd
SSDEEP 12288:O4YW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:O4f5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1586523281D9A45A4D30D46B3A68BC64475B07C31B02746EF7326BCCCBA7A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 3e8e60f654406e04d33e421c3f10a76971cf4702c32b919a85834445912a98b1
MD5 5b0d26e802c780baf92e25ff88f92461
SHA1 9708914c1600aad5dd3d68dbd69b3f0b2146216e
SHA512 0108cdbeb0fc8cf8cd54271464db74a092f97a9d6b807377471701b3e9b0dce0937e5f146ee60e5013254a76476e8ea8b6b7a4e729dabc4ef661b726d5b540d8
SSDEEP 12288:KnYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Knf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T12F6523296C8E4564D30D4673964BC65869B07C32701746EF722AB8CCBE3A5F5B53843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 6fabea6f78be9e5d0c9c7689063d29550407aa6438e1799369d0b2b4d120dd4f
MD5 39093fed11c762f4d26825088e3dfb80
SHA1 3887b1ef2526344810b46c1a41a18d7dae85518f
SHA512 77cf4c12a29f38a4f017ba07df03b7935a724e106683946fb20efae83d3ea734ea068e1a39466bc15ebdd5efe00383895e5c5133c8d65b2d5cd6239850bbacb6
SSDEEP 12288:fNYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:fNf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1186523296C8A4664D30D46B3964BC65865B07C32702746EF722AF8CCBE3A5F5B53C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 58aba29a72b40c218bc276c2dac6ea32029ed062a2d1b7b8ca3b61fa424d2d1f
MD5 0d3d2b250257020e67dd5d4f38105d08
SHA1 b98638c8e9f05704db6fe0ae029de255d9768bd2
SHA512 d2f495312d5c3b550ae5a2012df629b0083dd17299501c222df3ed2c31d3e334d2dfd22fa81f2e3c3aac00ea1e412341fa63d76b17c8c61ebc3e34eefd8dded8
SSDEEP 12288:huYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:huf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1376523286C8A4564D30D46B3964BC65865B17C32702746EF722AF8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 60a2679a6fcb77555745a27b99074799e1daff280d650408dcddd71371754d6b
MD5 e326bbeb4f9e1de3f3324693781532f6
SHA1 7be2414819d12ac8b671d0c0dd11bab9e32a7bf8
SHA512 a7bda36556e2bcd744f4400409da27a6d27658ba83fb1690597149fafacaf4ebd953482461299b1a6d3c6c03b5c02f9cea9bb8c756b199061dd66705b61c165e
SSDEEP 12288:W1YW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:W1f5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1816523286C8A46A4D30D46B3964BC65469F07C72701746EF7226F8CCBE3A5F5B53843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 c85107bb6a05cf42bd596f794bd4994d2bb854e96afc41ef5eeaa0768af746a2
MD5 01221772e6d94792e50ee30ffe79d5a2
SHA1 c23dfaca047b3a932e77af961e9c6738123da24e
SHA512 65fba4ffcca715512abf71bf432a63d6be3425159700ba7ebc28f46b81098a7a34187884f5979de5b856922c08086e6b1686c82760704069e20572462a231fba
SSDEEP 12288:pTYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:pTf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T18F6523286C8E4564D30D46B3964BC65865B17C32702746EF722AF8CCBE3A5F5B53843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 b3ce50ce370052189700f33184426c4fd0f8498eb52b6d3b5be62521c4b3100a
MD5 53771c5670ad70f921aeb57da10e3782
SHA1 b42a798601b6fca01df3b30a2dd866277e828101
SHA512 953d7ead373996040428be5c8012c17aac95c14abb41f76e0753365b5017c22bdab67058c98168c0f84d9ca89f330e27adad4a14d36a96559f18f38d23e1a797
SSDEEP 24576:6fwvrk9RX6wkyAIpf5TpmwLt3iRu/ocxwKDJKIe05Qws:VMnYIprmwx3lwcx/Kt0F
TLSH
T11295DF29EBDC44E5E177923C89A7460AF2B17C691B31C2CF125A63AD0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0ffd8854a1ed9207d5055a7fbad02f00ac17353c9247d2a424ddfa52b57e7e62
MD5 b00f7e5084dc63b7937b6b7c27d91e30
SHA1 b195bae0b695f2d32e476bde99baf7434ccce45c
SHA512 7eaaaf3255a905d832028efe6075a64109fe20a5c8f8556afe9f540339f16d572ebb0d502aad98862252950592ba1363b7c179f6cae93e316148174a717a474d
SSDEEP 49152:+YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06rmwx3lwcx/Ky:qySzP2Px3lweSmF
TLSH
T1E7066C56A1A841D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 96b1e02742dcf64c371e4962fb022c7efd198b9846bfc45e894eaeadb3e9a5ba
MD5 9f50da981e8a116d8c257fbf8693c3e7
SHA1 03f577db451af4a891949aa3d4ae70085674b774
SHA512 b5e03a8acd94ca9e8c9e2691047e5d9649f8f1eefd6f8b286d9edd77c1a61eae94d788fe1c7ea942d668c4b4c7debde017722a51a73c8994f8576feaa4200075
SSDEEP 24576:847Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYMf5TpmwLt3iRu/ocxwKDJKIe05Qws:847JUQj4irIhCnDHUPfF/Krmwx3lwcxN
TLSH
T10665AE1DA3EC01E5E1BA927885158A1AEA71782D1F31CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f7e02251fcd9a0e9373f566bccf3c5fc71b9580e2e95b062bb1d0e0382568a95
MD5 c8e78a9f186df55c859a0c0a1afcd354
SHA1 92daf7e1b52f901b73c4fab0a6b95fcaa2f69503
SHA512 4768b2dca9b1c0444bb087480a75c5f6cdb842666bcba04d0423851aed26c243d68d4e0ad18fd101e6d28ff69ae9c4edb14917d834fa1329103b3970a5d97c45
SSDEEP 12288:0rsf9YW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:b9f5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1B275F119D29802E8C16E5276C7468A40B3737C2593E1D3CF62D0F9BE1F76690ADF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7377ad6c8c75529b168264f62c4cab3cce4fbee87edf7f82e6728820761f64a5
MD5 52db826c20bcae25074144150f26fd63
SHA1 670884b5551412b5051edc35ffdc6ebd90172b7f
SHA512 a1db8c870859c0230c99dbfd70cb51c41a3dd862569e8a383e9f766fd0538b41c0a18758fc69f1dfdc921018e73677725d3ba827fc0be7c0b25b2a74f5d301ba
SSDEEP 12288:dIm+LU3f+lCtQy1G9LeKmgNMFF/0OyCu:dxEUPTObXtqT/tyz
TLSH
T178252810766BD75FC6A940321E36C2CCA7707D41EE04AB0772C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 7e408d0e48b90f31f7e4e22712f84b162571ec9ad9a0cdc5a590c11104a3c711
MD5 951b0a65fcf281c623a3ece5f5281079
SHA1 0c240d0cdf507b57049955740ac4433bf342f703
SHA512 2b4bc151e555c837767fc2e89a6b3c8b0ec68b6a56d465e78c1ad0b16e18e9691059aa0b1edf455aab8e4a6602e856bcff644e38a81b6230a92849c5199bc705
SSDEEP 6144:Zi9DPERwJJxfujoJZwzbNNjxKa/s26tMxb26tMxpEes/LTBA9IXAWp:MwzbNNjxKa/MOQE
TLSH
T18D55C6816537A3DFD1F62032072A5B4CA774EC07B7496F2673C4453AD86AB26A0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 1750e6b02bd82773935d3be4e9b2a91600624164f4a208e061f13f581808ca74
MD5 d9e831a00eb3bb52a260d1e27c0d4b06
SHA1 d7dab86196d7746015588eed329fe1fab14f0e3d
SHA512 89b8a132f1a0e3fc095d507c50e8fc1811008ff158e88a3253dcc51367e128f81d3d176b0aadfa8b41fe3a6f0593d6e61f72068f4281beb284449c533675d17c
SSDEEP 12288:ve7lYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:alf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1627523295ACD8964E73E4AB3554FC2243571BC30671185EFB216B8CCB9369E4ED3842F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b185b6cd33773ca4f324d0c0ed8ac848b432661ba711e78ccff6e7240a8615d7
MD5 26842afedaff1c1a99ac862131e511a0
SHA1 bced4b0da68c398ab846e23431a5f4042d21ad50
SHA512 b8defe08ba14144c8e89aeb522613b17895d3c733b3b1f92e9417190f9f93848c67e8dfe8f779227ad2674e3afa923173f09822dbb7c3a6b64d2f155890fcce8
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYff5TpmwLt3iRu/ocxwKDJKIe05Qws:7gb4mBIBhGFMrmwx3lwcx/Kt0F
TLSH
T16C65AE1E22EC02F5E1F9D2B8DDAA4417D6B278160332D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7bea3f0dc98496263c4bb170314daa11428099cfe434a5c2f59ca770a342e3de
MD5 bd79d43c3936d4227e16e7ee49b3044e
SHA1 61c4e5db90ae1d197c516a62ad0851590021bacd
SHA512 29f4a9cc1800ee429ef593db664ed8ef26a6e3934c431ee61068dfb86f6cf0a589b0b3a6a999f8a93a42334a92c64433c554f67b12284fcb8029ff9f6d9869e7
SSDEEP 24576:hG88u8FpJqH11zria7/m8f5TpmwLt3iRu/ocxwKDJKIe05Qws:k7ZFPqVsa7/Hrmwx3lwcx/Kt0F
TLSH
T1E9A5012577E101F0D47BD13889864663F6B2B8211364EFDF07A89A951F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bb70c7eea9376c9917fd02445233df48adb9c79882a533a3d87d426095ca3752
MD5 b53a8460d9b31b26aa64c4daf90c6c25
SHA1 959ea7ba20aa4c8b3fa46db7f6766fa0cf19bf1c
SHA512 5963ca35a438940fdfd33a88d302bf7e2e9456dea7e25c3283e2b11e57704c40f72ae51e876b966bff747964ff6f87d812be7726b9c56426b5ce136f52f5b2d8
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgrmwx3lwcx/Kt0F:XG05lO43btPx3lweSmF
TLSH
T1BED5CF6A62EC11F9D1BBC17CD9C6860BEBB23825033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8ab12037ae8a142b797257e53fabb13527622d9394587ff442312c69ea9f3f35
MD5 e3c99ce2bdb9eb277482021805b95c4e
SHA1 41329aa28cfbbef6acfa0af47c4136e0abaa3837
SHA512 26ae31f0e71ba5430381b067ad2f955fd082bee7ee7a31e715ee32a7d2ca936a1c0c3577ac9836c0ba636dfd88e1180611b3344259c36e144e9be86db7afaa54
SSDEEP 24576:wfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn6f5TpmwLt3iRu/ocxwKDJKIe05QL:Ia5POZ39Jt2pasx2+m4rmwx3lwcx/Kt8
TLSH
T12165AF5EA6EC01D5D179D17DC583861AF5B1382153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1abe6dbd431f2c57c11dd389e018da92f25a1ad4d7eb79faffc0b6d768457253
MD5 41331c972b2ebec43ae419a6799a4686
SHA1 510c10508bc28acd9e49ef4bbc21a66498540863
SHA512 8c7af5777531bb520ceafcb10180e8ef55834b203969df55af9796b50a30e23655575fe4baa60931fbac69a57f75808777a1797995c3216e17ddeb83be49c61c
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk0f5TpmwLt3iRu/ocxwKDJKIe05Qws:gNc/zEOVHFnrmwx3lwcx/Kt0F
TLSH
T19B857C1623E901E4F5BBE1BE89679546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b9944b898d3a7ab507b0773aaa69386d0d1888ac48fc59b9df59c6fa9802b5f8
MD5 a6085d8bd18f9e1fa601d6adb4bc173d
SHA1 5747c9172bc2f11e3733247eea14750e33d76af3
SHA512 7d84249468748124a0575c35bb4f82f55b7ac9d39e8a2b74ba6e8466965efac8f58592ab75d2bf3863ae0b9ac2663856d4f5e866337d79520b7e7a5818aaf6c0
SSDEEP 24576:3tkNvNnaFeYhJNtmZBmmf5TpmwLt3iRu/ocxwKDJKIe05Qws:3tMwBtOmmrmwx3lwcx/Kt0F
TLSH
T16855AF2EBAB846E4D1FEC6B5CD238512E6727861173293CF5290C13E1E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 2a7529e094dd9a76d63c8a17c5e93e2f0e10cfb451cf050eb128012810eb89e3
MD5 d5bc5a4117cc1b285f283273a7fb867e
SHA1 5f9aada102cf1492182d58d72227ac6bb0a6924d
SHA512 c596c5bf3d7c022c042d295f0548eb83b648cde43bf34d80fd8816cafc7fb2c4db7ee152a170e31838ae90425db1cd86f3e406a44ffbba5445489bdf17487051
SSDEEP 24576:lPUr+NQwf5TpmwLt3iRu/ocxwKDJKIe05Qws:lJQwrmwx3lwcx/Kt0F
TLSH
T10C85E12E26DD18E4E77AA17D85828709F7717C62131292CF02A1917E5F37DE8BC3DA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 a892ff21a5251c9aaa1a190c4b901409d9fe5aa81c4652a2505e9a8cd11e98d2
MD5 21b7d3fc38672e7512744fbdfb3cca4d
SHA1 47a3d31024eb61ee3a7065ee01b632f8f5acc92b
SHA512 8bc8eab3d49a6e57bdc5b72472eb451e9572922b92df5cfd6bf11f7f2bc44fb018e561d88219ac4e5df38dae33b9946c4455f9f018a8a9e1b5418ccd40701c74
SSDEEP 24576:mD3FHshBIYQgABf5TpmwLt3iRu/ocxwKDJKIe05Qws:mDVHeBIAABrmwx3lwcx/Kt0F
TLSH
T10795E03DEA9C04E4E57AC1BCDA538A06E7713CA9032256DB129491B91F3BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1920-79-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1920-294-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2184-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2184-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2184-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2184-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2660-130-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2660-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2660-128-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2660-122-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2660-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3052-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3052-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3052-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3052-307-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3052-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3148-78-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/3148-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3148-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3148-0-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/3148-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3216-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3216-39-0x0000000140000000-0x00000001401BE000-memory.dmp

Download

memory/3216-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3216-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3216-53-0x0000000140000000-0x00000001401BE000-memory.dmp

Download

memory/3420-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3420-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3420-108-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/3420-306-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/3640-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3640-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3640-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3640-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4100-321-0x00000228DF2A0000-0x00000228DF52B000-memory.dmp

Download

memory/5100-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5100-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5100-322-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5100-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5100-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5100-83-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5472-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5472-66-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/5472-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5472-279-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/5832-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5832-251-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5832-55-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5832-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5840-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5840-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5840-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5840-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5840-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download